How can I remove a VPN service when the remove button is disabled?

You can manually delete the service by removing it from the relevant preferences file.

Make sure System Preferences and any other software that may attempt to switch network locations is quit before beginning.

1. Make a backup of the preferences file.

   cd /Library/Preferences/SystemConfiguration
   sudo cp preferences.plist preferences.plist.old
   

2. Give yourself permission to the preference file.

   sudo chown $USER preferences.plist
   sudo chmod u+w preferences.plist
   

3. Open the preference file. I will use Xcode to open the file.

   open preferences.plist
   

4. Use ⌘F to open Find, and search for the name of your VPN service.

   

5. The name of your VPN should be shown in a UserDefinedName key.

   

6. Select the ID of the network service above the search result.

   In this case, I would select the one beginning CD2362…

   

7. Use ⌫ backspace to delete the entire dictionary. Make sure that the only data that is deleted is this dictionary and its contents, not any of the other dictionaries.

8. Save the file and reboot.

Some VPN interfaces must be removed from the VPN Profiles system preference, instead of the Network Interface system preference:

System Preference > Profiles > Select VPN profile > Remove.

In macOS X Sierra after coming across https://discussions.apple.com/thread/3828655?tstart=0 I was able to delete a VPN item that had a greyed out "-" button, even thought I had deleted the "Profile" it was associated with. I did so by the following commands:

1: In terminal, networksetup -listallnetworkservices gives a list of the names of the services.

2: In terminal, networksetup -removenetworkservice "name of service in quotes" will remove the desired service - the quotes are needed to take care of spaces and other fancy characters - they could be escaped with backslashes (\) instead. This might be the bit that messed up the original author.

3: In terminal networksetup -listallnetworkservices gives a list of the names of the services, hopefully showing that the undesired one is now gone.

networksetup -removenetworkservice networkservice SHOULD be "networkservice" The networkservice was the name of the VPN.

For the last one, If you cannot remove the network configuration because you get an error saying it is the only network service on ipv4, click the plus button to add another network configuration, and add one that would be on ipv4 such as 6 to 4, you can then use the terminal command to delete the configuration you were attempting to delete before, and remove the 6 to 4 using the minus button.

See: https://www.jamf.com/jamf-nation/discussions/19838/can-t-remove-vpn-network-service-created-by-configuration-profile